Spot the bug in the CORS helper

Node 24 intermediate 4 min 1 issue to find

Find the security bug in this generated credentialed CORS helper.

JavaScript

function addCors(request, response) {
  const origin = request.headers.origin;
  if (origin) {
    response.setHeader('Access-Control-Allow-Origin', origin);
    response.setHeader('Access-Control-Allow-Credentials', 'true');
  }
}

Open in playground

Report an error